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SUMMARY 


Two of the Lockheed L-1011 automatic flight control systems - yaw sta- 
bility augmentation and automatic landing - are described in terms of their 
redundancies. The reliability objectives for these systems are discussed 
and related to in-service experience. In general, the availability of the 
stability augmentation system is higher than the original design require- 
ment, but is commensurate with early estimates. The in-service experience 
with automatic landing is not sufficient to provide verification of Cate- 
gory III automatic landing system estimated availability. Component reli- 
ability is, however, generally tracking expectation. 


IKCRODUCTlOjN 


The L-1011 TriStar has been in airline operation since April 1972 as 
one of the cixcrent generation of wide-body jets. In service at present, 
there are about 8o units of the current model which is a short to medium 
range airplane that cruises typically at M =.85> Hp = 33jOOO feet. Maximum 

takeoff and landing, weights are 430,000 and 360,000 pounds. Figures 1 and 
2 show the airplane dimensions and flight control surfaces, respectively. 

The Avionic Flight Control System (AFCS) of the L-1011 is highly redun- 
dant in comparison to such systems of the previous generation of aircraft. 
This redundancy to a certain extent is manifest in the so-called "cruise" 
autopilot portions of the AFCS, but this was more or less a fallout of the 
need for high redundancy in the Category III Automatic Landing System (ALS) . 
The configuration of the "cruise" portion of the AFCS yaw control channel 
was also affected by this Category III requirement. 

It is intended in the following discussion to provide brief descrip- 
tions of the automatic yaw cruise control system and of the automatic 
landing system, these descriptions to provide the background for judging 
system redundancy in comparison to other systems familiar to the reader. 

It is further intended to present in-service derived data describing the 
reliability of these two systems and to relate this experience to expec- 
tation. 
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AFCS OVERVIEW 


The complete AFCS including Category Ilia automatic landing was certifi- 
cated at the time of initial airplane FAA certification in April 1972 . It 
has been subsequently so certified by Canada (MOT), Great Britain (CAA), 

Japan (JCAB), and West Germany (LBA). In the total fleet to date, there 
have been about l60,000 revenue flight hours accumulated for approximately 
80,000 flights. 

Briefly the AFCS consists of four subsystems: 

Stability Augmentation System (SAS) 

Autopilot/Flight Director System (APFDS) 

Speed Control System (SCS) 

Flight Control Electronic System (FCES) 

The components which comprise the AFCS are listed by subsystem in 
Table 1 . For total systems function, these components interface with other 
airplane elements such as sensors-air data, attitude references, radio 
navigation and altimetry systems, electrohydraulic and electrical flight 
control servos, flight instrimients , control panels, etc. 

The SAS functions include yaw damping, turn coordination, runway align- 
ment during automatic landing and automatic steering during the landing 
rollout . 


The APFDS provides for automatic control of the airplane from takeoff 
to landing. There are the usual modes of 

Roll and Pitch Attitude Hold with Control Wheel 

Steering (CWS) and Turbulence Configuration Control 
Altitude Select and Hold 
Vertical Speed Select and Hold 
Airspeed Hold on Pitch 
Mach Hold on Pitch 
Heading Select and Hold 
VOR and Area Navigation 
Localizer Capture and Track 

In addition, there are the common axis modes of 
Approach 

Approach/Land (Autoland) 

Go -Around 
Takeoff 

The pitch commands for Go-Around and Takeoff are derived in the SCS with 
Takeoff being a flight director mode only. 
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The SCS autothrottle modes are: 


Airspeed Select and Hold 
Stall Margin Control 

The lattei? is primarily an approach/land mode which uses angle of attack as 
the basic reference. And as just mentioned, the SCS also provides for the 
Go-Around and Takeoff modes using angle of attack as a reference. 

The FCES provides a number of functions such as electrical pitch trim, 
Mach trim, Mach feel, stall warning, altitude alert, primary flight controls 
monitoring, automatic ground speed brakes and direct lift control. All of 
these functions operate when either pilot or autopilot is in control. 

With these descriptive remarks as background, further discussion is 
confined to the SAS cruise control system and to the Automatic Landing 
System. Each of these systems has operational availability/reliability 
requirements which we shall examine and relate to the reliabilities achieved 
in service use. 


STABILITY AUGMEMTATION SYSTEM (SAS) 


System Mechanization 

Figure 3 depicts the cruise configuration of the SAS. Each of the two 
yaw computers contains two computation channels that output identical servo 
commands to an in-line monitored electrohydraullc servo. Four aileron 
position transducers and three rate gyros service the four computation 
channels of the total system. The rate gyros provide for Dutch roll damping 
inputs and the aileron transducers provide for turn coordination. 

Figure 4 shows one channel of the SAS cruise computation. It is seen 
that the gains are scheduled with flap position and the gyro path has the 
usual low frequency washout filter plus a high frequency cut-off. The 
aileron input path has a limited washout to remove aileron trim effects 
and in addition an adjustable dead zone such that turn coordination only 
comes into play for sufficiently large aileron inputs. The passed signal 
is subject to gain changing to match the gyro channel and to low pass 
filtering. The voter output to rudder siurface response can be approximated 
by a two Hz second order servo for small amplitudes. However, the primary 
control surface servo is severely hinge moment limited in cruise flight. 

It is noted that in Figure 4 the output of the computation comprises 
one input to a voter. The other inputs are derived from the other three 
computation channels of this dual-dual mechanization. As one would expect, 
there are two computations and two voters per yaw computer with two voter 
outputs required to drive one SAS electrohydraulic servo as depicted in 
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Figure 5 • The two voter outputs provide for driving the EHV colls in a 
push-pull arrangement with two sets of dual monitors acting to shut off 
the servo loop hydraulics if a fault is detected. 

There are also monitors in front of the voters which control the 
signal configuration of the voter inputs as shown in Figure 6, This figure 
illustrates the concept whereby the monitors eontrol switching logic that 
substitutes signal ground or an alternate computation for a faulted channel. 
Figure 7 shows the voter input crossfeeding for the complete dual-dual 
system. 

In addition to servo and computation monitors, there are rate gyro 
monitors and electrical power monitors. The latter operate into the servo 
engage logic while the former monitors operate into the voter switching 
logic. 


Design Objectives and Performance 


The function of the cruise mode of the SAS is, of course, to provide 
improved Dutch roll dairg)ing for enhancement of passenger comfort and 
handling qualities , and for reduction of fin loads . This reduction of 
vertical tail loading, in continuous turbulence, due to the action of the 
SAS was reflected in the definition of limit design loads. 


Early in the development of the L-lOll, the effectiveness of the SAS 
was investigated to determine performance and reliability objectives for 
the SAS from a loads viewpoint. It appeared that a minimum damping ratio 
of 0.3 and a timewise availability of Slio were modest design objectives 
that would yield significant load reductions. It was subsequently found, 
however, that higher damping ratios could be achieved over most of the 
climb, cruise and descent flight regimes as seen from the data given in 
Table 2. Only at low speeds, where effects on fin loads are not critical, 
are the damping ratios less than 0 . 3 * 

It also became evident that a Slio availability requirement was a very 
conservative estimate of system reliability. On the basis of guaranteed 
failure rates, the single channel failure rate was calculated to be about 

10~2 per hour and to preclude the possibility that an airplane might be 
flown without SAS for a protracted period, it is required that at least 
one of the two channels be operative for dispatch. Recognizing that for 
most flights both channels of SAS are operative, even 99-9^ timewise 
availability would appear to be conservative. 

A complete discussion of the effect of SAS availability on loads is 
given in reference (l) from which Figure 8 is taken. This figure illus- 
trates the definition of design loading for vertical tail shear with 0, 97^ 
and 100^ SAS availabilities. It is based on a mission analysis criterion 
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whereby the frequency of exceedance of a load quantity is calculated for 
operations over specified design flight profiles. The turbulence environ- 
ment as statistically described for each segment of a profile is applied 
to the airplane/load transfer function to derive exceedance curves (with 
or without SAS operating) for each segment. The segment exceedances are 
summed over the total of all profiles to determine a load vs. frequency- 
of -exceedance curve for the mission. 

H 

It can be seen from Figure 8 that the major reduction (— = 0.70) is 

realized by having at least 97^ availability and further reduction comes 

G 

less readily with 100^ availability realizing a ratio of — = 0.65. These 

J? 

results are for a fully linear system and saturation effects reduce the 
benefits somewhat. In summary, however, with 97^ availability the net 
reduction in fin loading is better than 25 ^ relative to what it would be 
if no SAS were available. 

It woxild be very surprising if the in-service reliability indicated 
a SAS availability of less than 99>9^* Ttie con 5 >onent MUlSF values are 
tracking guarantees as indicated in Table 3* There have apparently been 
only five con 5 >lete in-flight losses of SAS and a very few delays as a 
result of lack of immediate parts replacement. These instances with one 
exception were associated with dispatch for many consecutive flights with 
a failed confutation channel. The number given above for in-flight losses 
covers a period in which revenue flight hours were accumulated with an 
average flight time of two hours. We believe that there have been no other 
instances of complete loss to date , and that it is conservative to use only 
that period for which detail records have been evaluated in estimating the 
total system failure rate. On the basis of actual total in-flight losses 
during the period evaluated, the SAS availability woTild be 

1 ^ (5 losses) (-g- average flight time) 
total flight hours 


or about 99«98?^« The individual SAS channel in-flight failure rate was also 
examined and it was found that 6o channel failures were experienced in a 
30,000 flight hour (2 -hour flights) period. This indicates a SAS channel 
MTBF of 1000 hours which is commensurate with the data of Table 3* 


SAS Conclusions 


With respect to the yaw stability augmentation system, the following 
conclusions can be drawn: 

o 97^ availability is an extremely conservative value upon 
which to base design loads. 
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o With current technology of design, manufacturing and 
airline maintenance, single channel SAS reliability 
should be adequate to support fin loading design 
criteria as established for the L-1011. 

o L-lOll dual channel SAS provides fin load alleviation 
for all practical purposes equivalent to 100^ SAS avail- 
ability. 

AUTOMATIC LAfflDING SYSTEM (ALS) 


System Mechanization 

The principal elements of the ALS are the APFDS and SAS and their 
respective sensors in the configurations established with the Approach/ 

Land (A/L) mode selected. The system in total definition includes much 
more than these units but these have, by far, the most effect on system 
reliability and availability. Reliability is used here in the sense of 
the system capability to complete a landing. It relates directly to 
safety, particularly in low weather minima operations. It was, of course, 
the Category III requirement that dictated the extent of redundancy in the 
ALS. This redundancy is depicted in some generality in Figure 9 'tti® 
pitch and roll control axes. Each of these axes uses three accelerometers 
(normal or lateral) and three attitude inputs. Pitch computations use 
only derived pitch rate; roll uses both attitude and roll rate signals. 

The Autoland Sensor signals are glideslope error and radio altitude for 
pitch and localizer error for roll. Only two each of the Autoland Sensors 
are used but each has dual outputs with high integrity self -monitoring. 

For example, the probability of the two signals from one C/S receiver being 
faulted at a critical time without warning is less than lo"^* 

The same theme of APFDS redundancy is carried over into the SAS in 
the A/L mode as seen in Figure 10. Here, the exception is that only two 
compass systems are utilized which do not have the integrity of an Auto- 
land Sensor. The redundancy requirement, however, is not as great for 
yaw control as it is for pitch and roll, (in the development program, 
automatic landings with no automatic yaw control have been demonstrated 
without any significant effect except that the pilot had to control the 
rollout.) The compass inputs are actually compared in the SAS computers 
and used to define a reference heading error which is memorized. The 
compass signals are switched out at 150 feet and integrated rate gyro data 
is used from there to touchdown. (The radio altitude signals used to 
control this function are omitted from Figure 10.) During this time, a 
maneuver is performed whereby the aircraft fuselage is aligned with the 
runway and a wing down is held against crosswind. 

This use of the compass points out the difference between the safety 
and availability aspects. For Category Ilia conditions, the align 
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capability is required, at present, and if one compass system fails on the 
approach above the alert height (lOO feet for U.S, Carriers), a missed 
approach is executed. Safety implications are minimal, but as far as avail- 
ability goes the day is lost. 

As would be expected, the fail-operative pitch, roll and yaw (below 
150 feet) mechanizations closely follow that as depicted in Figures 5, 6, 
and 7 for the cruise yaw control. Four computation channels for each axis 
are needed for the fail-operative condition and two or three for the fail- 
passive condition. The latter configuration is acceptable for Category II 
operations while the fomer is required down to the alert height for Cate- 
gory Ilia. There are minor differences in each servo control and monitoring 
mechanizations, but the basic concepts of Figure 5 are applied. For Cate- 
gory III, of course, it requires two servos per axis while one is acceptable 
for Category II. 

Much is left unsaid about other subsystems of the ALS, such as 

o Speed Control System 

o Automatic Pitch Trim 

o Direct Lift Control 

o AFCS Mode Progress and Warning Indicators 
o Flight Instrument Systems 
o Hydraulic Power Sources 
o Electrical Power Sources 

In the interest of completeness, however. Table 5 is given to provide a brief 
summary of the major elements of the total ALS. It is also noted that a 
more complete description of the AFCS is given in Eeference 2. 


ALS Objectives and Development BesilLts 


There were three L-1011 program objectives with respect to the ALS. 


1. Achieve a Category Ilia certification with a 
system having the potential for Category Illb. 

2. Develop a maintainable system. 

3 . Develop a system which has a reasonably high 
availability. 

There is no doubt we held tenaciously to achievement of the first objective 
and we like to believe we have done the same with the other two. It may 
not have always been apparent, but we believe we are tracking fairly well 
even though it is perhaps too early to have all things proven out. 

It is a fact that we certified for Category Ilia with the FAA on 
schedule; but, as you are probably well aware, the manufacturer's certifi- 
cation is only the first of a series. Each operator must verify its 
capability to use the system to the satisfaction of the same regulatory 
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agency. One L-1011 operator has accomplished this; others are working at it. 
In the meantime, we are beginning to look toward achieving a Category IlXb 
capability. ' 

One of the things an operator must show to achieve an ALS certification 
is his ability. to maintain the system. An indication of this capability is 
a comparison of failure rates achieved with those used in the Lockheed certi- 
fication analysis. In effect, MTBF tracking limits are defined. Table 4 
shows a list of MTBF lower limits and their currently estimated values. The 
data given in this table are for the significant contributors to the total 
disconnect probability (below the alert height). If the MTBF's of all the 
listed units were at the lower limits, the total disconnect probability would 
be potentially a factor of two higher, still within acceptable limits. These 
"lower limits" are not absolute limits in view of the fact that the two 
factor does not put the disconnect probability to an unacceptable level and 
further one low MTBF value could be compensated by a high one. To a certain 
extent the limit is a tracking limit to signal for more detail examination of 
a potential trouble area. So far, however, things seem to be tracking fairly 
well. 


With respect to ALS availability, there is very little data to display. 
The one airline operator that has received a Category Ilia certification has 
shown in his initial data gathering period results to support the certifi- 
cation requirement. The reported results support the reliability prediction 
but do not allow correlation with the availability estimates of Figure 11. 
This figure gives a prediction of the Category Ilia ALS availability as an 
operational day (l4 hours) progresses. It is assumed that 10 hours are 
reserved for maintenance and that the ALS is apparently restored to a fault- 
free condition by the start of each day. Mature failure rates were used to 
make the prediction. 

The curve of Figure 11 may well represent an upper value on availability 
for the ALS, but at this time we cannot say. We shall find out, however, as 
we are now embarking on a program for evaluating availability in cooperation 
with one overseas operator. And we feel confident that the system will prove 
out well. 


ALS Conclusions 


The progress with the L-1011 to date has shown that certifying and 
supporting the maintenance of a highly redundant automatic landing system 
can be accomplished in a scheduled manner much like any other flight control 
system. Further, it is expected that future progress will serve to demon- 
strate that the redundancy and complexity will not detract from the economic 
benefits of system utilization. 
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Table 1. - L-1011 Avionic Flight Control System Equipment List 


Stability Augmentation System (SAS) 

2 Yaw Computers 

3 Rate Gyros 

2 Aileron Position Sensors (dual) 

2 Rudder Position Sensors (dual) 

Autopilot /Flight Director System (APFDS) 

2 Pitch Computers 

2 Roll Computers 

2 Pilot's Control Wheels 

2 Mode Annunciators 

2 Warning Indicators 

1 Mode Select Panel (5 modules) 

3 Normal Accelerometers 

3 Lateral Accelerometers 

Speed Control System (SCS) 

1 Speed Control Computer 

1 Autothrottle Servo 

2 Longitudinal Accelerometers 

Flight Control Electronic System (FCES) 

1 FCES Computer 

1 Trim Augmentation Computer 

2 Angle of AttAck Sensors 

2 Stick Shakers 

1 Surface Position and Pitch Trim Indicator 

10 Surface Position Sensors 

2 Control Panels 
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Table 2. - L-1011 Dutch Roll Characteristics With and 

Without Yaw SAS 

FLIGHT CONDITIONS (MID CG) ' 

DUTCH ROLL MODE 
DAMPING RATIO AND 
DAMPED NATURAL FREQ 


404 

UP I 

UP 

308.5 ' 

■■ 

UP 

UP 

4oo 

UP 

UP 

350 , , 

UP 

■ 

UP 

300 

UP 

UP 

300 

UP 

UP 

350 

UP ! 

.. UP 

300 

UP 

UP. 

300 

UP ; 

1 : 

; UP 

308.5 

i UP 

UP 

308.5 

1 UP 

UP 


SAS ON 




SAS OFF 


t 
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Table 3 « - SAS Reliability Summary 

Item 

No. Of 
Units 
per SAS 
Channel 

No. Of 
Units 
Per 

Aircraft 

Latest Point 
Estimate 
MTBF per Unit 

Latest MTBF 
Estimate 
@ 90^ Confid. 

Mature 

Unit 

MTBF 

Yaw Computer 

1 

2 

10,900 

6,800 

4,600 

Rate Gyro 

2 * 

3 * 

10,200 

6,300 

6,400 

Aileron Position Sensor 

1 

2 

— t 

47,100 

222,000 

Rudder Servo 

1 

2 ** 

— t 

23,500 

24,000 

Control Panel 

1 

2 ** 

— t 

23,500 

206,000 

Hydraulic Source 

1 

2 

5,500/9,600 

3,300/4,800 

10,000 

Electrical Source 

2 * 

3 * 

— t 

23,500 

167,000 

* One gyro is shared by each SAS channel as is one electrical source, 

** Any elements common to both SAS channels are negligible re MTBF estimates, 
t There were no failures in reporting period. 

Table 4 . - Estimated MTBP's vs MUBF Lower Limits 

Item 

MTBF Lower 
Limit 

Latest MTBF 
Point Est. 

Mature MTBF 

Roll Servo 

4,000 

* 

20,000 

Pitch Servo 

.. 2450 

* 

49,000 

Roll Computer 

1,675 

1,800 

3,350 

Pitch Computer 

1,350 

3 , 4 oo ' 

2,700 

Yaw Computer 

2,300 

10,900 

3+765S 

ILS Receiver 

1,750 

5,400 

3,500 

Radio Altimeter 

1,750 

9,100 

3,500 

Vertical. Gyro 

T7H5o 

5,200 

3,720 

Lateral Accelerometer 

31,700 

** 

63,500 

Normal Accelerometer 

31, 700 ' 


50oo 

Warning Indicator 

9,600 

9 , 100 . 

48,00^0 

Aural Warnisag Unit 

30,000 

V- V \/ 
A A A 

150,000 

Hydraulic Source 

2,000 

5,500 

10,000 

* No reported failures in 5 ^ 
** No reported failures in 83 
*** No reported failures in 2 'i 

^ ^ ^ 

l-jOOO servo flight hours. 

.,000 accelerometer flight hours. 

%000 flight hours. 


790 


ftB2»RODUG©ILITY OP THE 
PAGE IS POOB 




Table 5* - Automatic Landing ^stem Bfejor Elements 


No. 

Item Req. 

Pitch Con 5 )uter 2 

Roll Computer 2 

Yaw Con 5 )uter 2 

Roll a/p Servo 2 

Pitch A/p Servo 2 

Yaw A/p Servo 2 

Aileron Position Sensor 2 

Rudder Position Sensor 2 

Yaw Rate Gyro 3 

ffode Annunciator 2 

Warning Indicator 2 

Mode Select Panel 1 

Normal Accelerometer 3 

Lateral Accelerometer 3 

Attitude Gyro 3 

Radio Altimeter 2 

ILS Receiver 2 

Speed Control Coaputer 1 

Autothrottle Servo 1 

Longitudinal Accelerometer 2 

FCES Computer 1 

DLC Servo 2 

Trim Augmentation Con^juter 1 

Angle of Attack Sensor 2 

Air Data Computer 2 

Altimeter 2 

IAS/M Indicator 2 

VSI 2 

ADI 2 

HSI 2 

Radio Altitude Indicator 2 

Compass System 2 

Hydraulic Source 2 

Electric Source 3 


Remarks 


Each con 5 )uter is dual channel. 


Each servo is in-line monitored. 
Each sensor is dual. 

II ll If It 

Each has limited in-line monitoring. 


Each has limited in-line monitoring 
Each has dual outputs with high 
integrity monitoring. 

Con^uter is dual channel 
Servo is in-line monitored 

Provides for fail-op/fail-pass DLC 
Each is in-line monitored 
Provides for fail-op/fail-pass 
auto pitch trim. 

Each has limited in-line 
monitoring. 

Each has limited in-line 
monitoring. 
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-1011 General Arrangement 
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Figure 2 Control Surface Arrangement 
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Figure 3 Stability Augmentation System-Cruise Mode 
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Figure 4 Yaw SAS Cruise Mode Computation 
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Figure 6 Voter Input Switching 
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Figure 8 Frequency of Exceedance of Vertical Tail 
Shear With and Without Yaw Damper 
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Figure 9 APFDS Approach/Land Mode Configuration 
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Figure 10 SAS Approach/Land Mode Configuration 





